One Request to Rule Them All: Critical Trendnet Flaw (CVE-2025-15471) Allows Total Takeover

A critical pre-authentication command injection vulnerability CVE-2025-15471 has been uncovered in the Trendnet TEW-713RE Wi‑Fi extender, allowing remote attackers to seize full control of the device with a single HTTP request. The flaw carries a CVSS score of 9.8 and stems from a design that exposes a highly dangerous system management interface to the open web without requiring a password.

At the core is the formFSrvX handler within the device’s firmware, which accepts a parameter named SZCMD and blindly executes the value it receives, meaning arbitrary code can be run via a crafted web request to the /goformX/formFSrvX endpoint. An unauthenticated attacker can fully take control of the device, enable backdoors (telnet/ssh), intercept traffic or use the device as a pivot point inside the local network.

The report outlines four remediation steps for the vendor: remove shell execution, enforce authentication, whitelist commands, and apply least privilege so the web server does not run as root; until a firmware update is released, users are advised to restrict access to the device’s management interface and ensure it is not exposed to the public internet, according to Daily CyberSecurity.